We Are At War!

Possibly. The story has been running in the computer press for a fortnight or so -- google “Stuxnet Iran” but it’s gone mainstream with articles in the Economist this week.

A specific malware -- called Stuxnet by its original discoverers -- turns out to be:

• Very sophisticated, robust and prolific, particularly well able to travel on USB memory sticks to infect systems kept off the Internet
• Targeted rather specifically to attack WinCC, a notoriously insecure plant and process control system from Siemens
• And, weirder, even at sites running WinCC, despite all that specicifity, it doesn’t do any of the harm it is capable of. Except in Iran.

Because it seems that the Iranian nuclear fuel and reactor plants run WinCC. And when it’s activated in Iran -- the details of that aren’t clear -- it causes harm.

Cutting a long story short, the line offered to us is that Stuxnet was build by a well-resourced team to smash up the centrifuges at Natanz or even the reactors, by disabling the computers that manage them. The Americans are said to have form here. The Israelis have an obvious interest. And both nations have deep capabilities in development and experts in malware analysis.

I think this could very well be true. Stuxnet is really hard to explain on any other theory. It “wasted” a previously unknown Windows vulnerability on an esoteric target -- a weakness that could have made millions installing Zeus to collect banking passwords. The “waste” is just as gross when you consider the huge skill and work that’s gone into the code -- just to bugger up some plant for no obvious economic benefit.

So, Stuxnet is a weapon in an undeclared war against Iran. And that’s interesting because it’s a first look since Titan Rain at what modern information weapons look like. And what do they look like?

Well, unimpressive, mostly:

• Slow. Stuxnet has been around for months, and if there was an effect at Natanz, it took a while.
• Expensive. There’s a lot of effort in that code, no doubt, and a lot of investment in the test and development rig it first ran on, but the real cost is that as soon as it goes public it betrays the zero-day vulnerabilities it depends on for its unique spreading capabilities. Zero-days are wasting assets -- and the clock starts running the moment they’re used.
• Weakly targeted. Stuxnet went global. It was designed to limit the harm in non-target sites, but it would be better from the security point of view if it had never got there. Global distribution tipped off every WinCC site, including the Iranians to get smart.
• Limited scale. You can’t do wave after wave of this sort of attack, as the victim will tighten up their patching and filtering, and at any time the supply of zero-days is limited.
• Limited effect. The Iranians still have a nuclear programme.
• And, finally, there’s no magic. No doubt Stuxnet is quality work, but it’s just a well made malware. Like all current malware, it’s a combination of understood techniques.

That last one seems crucial to me. If you do all the things that you should be doing to manage routine malware and zero-days: endpoint, removable media, gateways; then you’re also, and entirely for free, building yourself a bunker which will stifle many of the best efforts of the “cyber” warriors.

I’ve been meaning to write about the boondoggle called information war, but it will have to wait. All I’m going to say here is that I’ve felt for some time that even the idea of IW is unsound -- a hysterical reaction to the pathetic network security seen in the United States and the defence establishments of other countries. If Gary Mackinnon can break into your systems by guessing telnet passwords, then, yes, probably you are at risk to rather broad attacks. But that has nothing to do with expanding warfare into the cyber domain and, frankly, everything to do with being a tosspot.

In the meantime, for the rest of us, the lesson of Stuxnet is that Information Warfare is, and remains, a matter for routine operational security.

Not Invented Here

This has got nothing to do with anything I know about, but it's got me cross so here goes.

My little Samsung music player is old now, but it does all I want. It loads up as though it was a USB stick. I can find the music I want navigating up and down the directory tree with folder and track names showing on the tiny four-line display. It plays .wma, .ogg and .mp3 files, and when I'm bored with my files, there's an FM radio.

I would have thought that this counted as some sort of baseline. iPods have a display for album art and video. Other players have integrated phones, or glossy appearance, or Bluetooth audio, or who-knows-what magic. But for a £40 player, I was happy.

One thing the Samsung doesn't have is the oomph to drive any sort of speaker without caning the battery. Nor should it, but it's a bit frustrating sometimes when your ears are tired of buds, that there's no way to fill the room with it.

This shouldn't be a problem these days. Quite a lot of music centres and boom boxes support "USB" which is a shorthand for digital music on popular media. Except they don't -- the support is rubbish. I looked at Cambridge One and the Yamaha desktop music player -- both about £300 -- and they were both really disappointing:

• For a start, it's MP3 only. Compared with my Samsung, the hifi designers have vast resources of electrical power and size, so there's no excuse for limiting the playback decoders.
• There's not much point in a remote if the buttons are hopelessly obscure. The navigation is hard.
• And it's worse when the UI can't even display a directory listing. I've got 2GB of music on that thing and ignoring directory names is not going to help.
• And in the 21st century, I reckon we're entitled to a decent screen, but what we're offered is a single line. I felt that I was fortunate under the circs to see the ID3 tags in an unsatisfactory fixed-rate marquee.

What's happened here is that someone has made the minimum possible hack to the code that plays MP3 CDs. The idea of picking up a few hints from the players made in a different division of the same firm just never occurs to anyone. All I want is something that can play the same files as a cheapo portable, and provides a simple user interface. Hard? Apparently so.

Wrong Impression

I was very taken by this picture from the front page of the LogMeIn site.

On the site it's animated: we have  the shady character in an upstairs room hacking away at an unattended machine in an empty office.

That can't really be the impression they want to give, can it? Is that what they're selling?

Not Idle; Moral!

In a month or so, every adult who works as an employee or volunteeer with children or other vulnerable groups has to be registered with the Independent Safeguarding Authority. This is an extension to the current criminal record check, because the assessment is continuous. What that means is that if a rumour or suggestion falls into the hands of a police force, government agency or local authority at some future time, the registration can be withdrawn at that point, and the employer/organiser warned off, unattributably, under pain of a £5,000 fine.

The Home Office are saying that there will be more than ten million names on the list, dispensing information from hundreds of sources to hundreds of thousands of users, and the records will be up-to-date and truthful. Since the aim is so laudable, and the consequences of screw-ups so dire to innocent and guilty alike, we must wish them "good luck with that".

I'm not against this sort of thing overall. The test is always to move away from the emotive area of child protection and see how we feel then. If you apply for a bank job, is it good that your proposed employers is able to learn about your convictions for swindling or your creditors arrangement before they give you the safe keys? Yes, it is. Society is mobile and people do use that to hide. But this scheme fails for me, on top of its basic impracticality, because its boundaries are just too wide -- essentially, if the criteria for inclusion are fair and worthwhile there's no good reason why it shouldn't be applied to parents or at least step-parents, and that takes it into political and moral absurdity.

But I do have a slight problem. You see, the papers are full of warnings that volunteers -- the sports organisers and the reading assistants and millions of other helpful people -- will be deterred by the unpleasant thought of being on a list where they are graded and assessed for the risk they present to children. And this is a colourable view: the rules of the Standards Board certainly reduced the number of upright citizens willing to serve as parish councillors, and certainly I reckon I would much rather be judged on whether I had declared all my financial affairs than have some civil servant noting that my late marriage was a marker of sexual irregularity and a risk factor for proneness to abuse children.

On principle (like I say, it's a bad scheme, see?) I won't be registering, and that means I won't be volunteering, and will have to decline requests that I do so. But I am also aware of a slight hint of relief as I make that choice. Essentially, because of my strict moral standards, I can't do PTFA stuff; I can't do carpools, I can't mentor, I can't help with reading. All these things which I didn't do before, because I was a bad person, I'm now not doing because it's important to make a stand against idiot completists in the civil service. Result!

I'm not doing anything this evening: Fancy a swift half in the Angel? See you there.

If You've Done Nothing Wrong, You've Got Nothing to Fear

So we're told. But it didn't work for Jacqui Smith.

I Have Been Advised....

Mr Infrastructure sent me an email. He was escalating an issue his team had with security policy.

One phrase stood out: "I have been advised..."

This is the greatest cop-out ever. It means: "Because I don't claim to understand this, you can't challenge me on it. I win."

I challenged him.

Financial Insecurity

When I drafted this this morning, I wondered if I was only one who interpreted this as a cabinet minister threatening Goodwin with a bill of attainder? A quick google shows I wasn't, and in fact there doesn't seem to be any alternative construction. The problem would arise at the ECHR and I suppose that's why mad Harry (or the rest of the government anyway) is backing away.

Mark my words. Sometime over the next few months, there will be a quiet announcement: The matter is settled, and the settlement is secret. Though the spokesman will be authorised to say that Sir Fred Goodwin has agreed to reduce his pension payments. And every year, £700,000 will be paid out -- under a variety of headings -- to Sir Bentnose.

Trusting Strangers -- Why Certificate Authorities are like Credit Rating Agencies

My list of causes of the banking crisis isn't quite the same as everyone else's. For me it generally boils down to moral courage. Because I have none myself, I can recognise that it was missing in plenty of differnt places.

• "Spineless non-Execs" rather than "Wicked Banker" and
• Fannie and Freddie for not making it plainer that they were lending on this stuff in response to government fiat rather than thinking it was any good, and
• Rating agencies for closing down credit discussion on the grounds that if it was good enough for Fannie and Freddie it must be A+ at least, and 
• Bankers (aha) for closing down credit discussion on the grounds that the securities were rated A+ by an independent rating agency, and .
• Bankers (yes!) for saying that as everyone else was making fortunes:
  
  
  • writing liar's mortgages at tempting rates, and securitising them on
  • lending to doomed ventures, and securitising them on
  • buying A+ securities that somehow pay three points over base, and securitising THEM on
  they had better do the same, or the shareholders would kick their arses, and
• Shareholders for kicking the arses of anyone who missed these amazing opportunities
• and you know who else? Lying or self deluding borrowers. That's us.

Oh. I'm ranting. Let me get this back on track. Check out the credit rating agencies. They're right in the crux of this. Their business is to turn more or less synthetic securities (anything from a strip or a mortgage bundle right down to a plain bond -- anything that's denominated in money rather than equity) into a capital "I" Investment. The fairy dust they sprinkle to do this is their rating. They form an opinion on the ability of the borrower to pay as advertised. That's not whether it's a good investment or the right investment for you, or whether the issuer will craftily exploit the early redemption terms or whatever. The rating is just Moody's or S&P's opinion on whether the coupons and face will be redeemed on the published dates. Ratings go from AAA which is supposed to be a dead cert  down to ccc -- and you'll never get an agency to agree a correlation between the rating and a percentage probability.

Because of a long history of grade inflation, pretty much anything that can't make at least an A is called junk and a lot of investors aren't allowed to touch it.

Sometimes the agencies rate because they want media attention or because their franchise demands that they have an opinion on some popular issue. More often, they rate because the issuer pays to get a rating needed to get the issue away. You can't buy a particular grade, but the agencies will advise on how to get it,  and if you're an investment bank there's such a thing as being a good customer of the rating agency..... I don't really need to spell this out. Suffice to say that the investor (the technical term is "victim", these days) has no contract with the agency. If Moody's were to rate a bundle of Motown mortgages as A -- and some agencies were doing that -- and it defaults, then the owner of the bond, who trusted the rating, has no come back to Moody's when the bond defaults. It was the agency's published opinion, no more and no less. You relied on it at your own risk.

Now I expect that at some point you could say it was negligence, and of course rating agencies are controlled by financial regulators, but my point is a little different. Because there's a very fine parallel to this in the world of Internet security. The whole technical paraphernalia of X.509 has one purpose: to tell you, reliably, that the certificate authority has certified that the far end is the correct user of a name. You are trusting the certificate authority to do the necessary diligence, to refrain from certifying incorrect users, to guard their private key. (You are also, in effect, trusting them to do things they definitely do not do, like ensuring that the sites they certify can keep track of their private keys -- that's why the system is mad.) For ordinary users, this trust is a matter of default -- it's installed with the browser. Sites pay CAs for certificates because CAs pay browser authors to install their keys. The free-rider is the user, and that's a bad thing. No payment == no contract == no rights. As the rating agencies have shown us.

Real Financial Insecurity

Prostitute's postcard seen today in a phone box in King William Street:

• A very conventional picture of a youngish woman in partial undress, and
  
• A site: "London Bridge" -- in reality that would be far out in the Borough, but never mind...

All ordinary. But what struck me was the caption. It wasn't "Maid for Pleasure." It wasn't "New 19 YO Swedish." It wasn't even that perennial City favourite: "Fully Equipped Dungeon."

No. The caption was: "Kisses and Cuddles." If that isn't the clearest sign of financial calamity, I don't know what would be.

God bless her, though. It's wonderful to imagine that there's a living in snogging.

The Current Status of the Pound

I'm writing this on 28/10 but I'm back-posting to the day it happened, right in the middle of the (first?) UK banking turmoil.
I had occasion to use the toilet in the headquarters of a big four bank. As I reached for the paper I noticed a little blemish on the white(ish) sheet. Being unsqeamish about this sort of thing, I gave it a little scratch and a shred of coloured paper came away on my finger nail. I pushed back my specs for a closer look and found a tiny fragment of a £10 Bank of England note -- barely a millimetre across, but the engraving and colour so fine as to be unmistakeable. That bank had been wiping their collective arses on thousands of pounds in fine rag paper -- and they never knew.
I do wonder whether it's co-incidence, or whether support from the BoE comes with an unpublished obligation to help them get rid of their pulp....

The Truths of Astrology

I am sometimes praised, mostly by me, sometimes by him or her, but very rarely by Them. So, this afternoon when I was very deliciously, loudly and fulsomely praised by the lovely ladies on the admin desk, swiftly joined by the very gorgeous customer service head, apparently with no motive other than to publicise my wonderful personal qualities, I was a bit perplexed. In fact I couldn't restrain myself from wondering what their collective game was. (And I still don't know)

I got a glimpse through the mists, though, on the way home. My horoscope in the thelondonpaper which they won't have seen, is absolutely explicit. It looks like a good weekend -- at least as a test of newspaper horoscopy.

How? Well, it couldn't be more obviously about me, and I have got -- as it happens -- a fine project to throw myself into and a number of things that need to come together. There's even a defined timescale.

We shall see.

UPDATED: 22:34 Saturday -- I assembled a chicken coop with plenty of flair, and energetically picked fruit in the hedgerows, but nothing yet.

UPDATED 21:53 Monday -- Overall the weekend has passed off like many others -- on Sunday I mowed the lawn, cut wood, picked apples... So it looks like a clear loss for astrology -- it got the right guy, but gave the wrong advice. And yet. At 3AM today, I woke with a clear sensation of being outside in a lightning flash with the roar still echoing in my ears. I was so terrified that I would not have been surprised to find myself blind with a Voice asking "umacf24, umacf24 why do you persecute me?" As it was, I shook with terror as I made my way to the toilet and then shook with terror in bed until I fell asleep. I don't think it was real lightning -- I'm too far from the window for it to have that effect. But as a way to bring things together in a rather intriguing way, it totally sucked. So I call this a draw.

Two Shiny Stories

So now we have the Google browser with a name that proves that the Septics do get irony. It's not chromy at all, but it does have two interesting stories:

• It is possible to keep big secrets for a long time. I don't know how long it took to go from concept to (beta -- surprise) release, but it can't have been less than eighteen months and even though a Google browser is a juicy story, all the news services all seem to have been taken by surprise. That's impressive. I'd like to know how they did it, and I wonder what other secrets they are keeping.
  
• Now that Google is just as wicked as Microsoft there's lost of fuss about the browser's licence and potential to phone information to Google (i.e. under the pretence of checking if the site you are visiting is phishing. But the source is under BSD so it ought to be possible for a forked "clean" version to appear on sourceforge any time. We'll see whether open source can still function without corporate support....

Two Observations

1. A sad little entry for change control at the meeting last week: ZWD the Zimbabwe dollar is now so close to worthless that the calculations overflow. Remove from the forex universe. No impact expected.
2. The may is at its peak. The madder thorns are now iced with a continuous white crust. As quickly as it came it'll be gone....

Safe vs Free

As vanity/personal sites go, Things of Interest is one of the best. There's a lot of interesting things -- simple but sometimes provocative and robustly logical. Presenting Arguably the most important question of the decade as a poll -- Would you rather be "Safe" or "Free"? is in that style.

As a man I wanted to select "Free", but as a father, I wanted "Safe". But really I knew that the poll was wrong. Here's a mockup of my version.

Which would you rather be:Safe¹ or Free?

¹ Please note that preferring safety to freedom will not make you safer. However the corresponding loss of freedom will be delivered promptly and reliably.

Mind you. It's probably too late for "Free", as well.

Microsoft Abandons AD Shock!

The Microsoft Dynamics CRM product is probably on the shortlist for every greenfield CRM implementation. It's on ours simply because we've slipped a couple of versions in our existing system.

It's no surprise. The system, developed entirely internally by Microsoft, is a showcase for the options available for .net applications: SQL, IIS, Async, Workflow and the rest. It's a modern architecture and I think it would be fair to say that this is how MS expect applications to be built now. Which means that it also contains a really good joke.

Remember Active Directory? I do, in fact I'm pretty sure it was going to be at the heart of the modern enterprise. What that means is a question for another time, what's clear for now is that Microsoft doesn't believe it any more. Dynamics CRM 4.0 barely touches the AD after the user has authenticated. All the access control, all of the organisational structure is built entirely in the application data structures. Domain groups? We've heard of them!

I asked whether this put the DBAs into an access control role we've tried to limit to the helpdesk. The answer was a peach: the data are very normal, but none the less too complicated to edit by hand. And the DBAs won't have the access anyway...

Goodbye AD. Goodbye ACLs. Goodbye integrated access control. I never really believed, but for a while I did hope.

Time Based Rant

My Blackberry 8800 is a handy little device. It's subscribed to a UK GSM network (the UK networks all have reliable GSM time) and it's a GPS receiver (of course GPS is all about time to the microsocond).

So why does the clock displayed on the front drift four or five seconds in a day?

Tossers.

Sir Arthur C. Clarke

His death is the important news today. Rumours about bank liquidity are secondary.

Terrorist Spies

I found out whether I believe in evil terrorists reconnoitring for their next target.

Rather to my surprise, it appears that I do.

At 06:50 I saw a clean-looking man in a hi-vis vest photographing an iconic tower, leaning back to get the upper parts in. After a few shots he hopped into a clean-looking, unmarked refuse lorry waiting at the curb and his mate drove him away. The photograph, the building just didn't hang together with the refuse lorry, and everything was really much too clean, so I noted the number of the lorry, and when I got to work, I wrote it all down.

I wasn't too happy with claiming that it was a terrorist planning exercise, though, so I tried it on a few people to see how it sounded. But I couldn't persuade myself it was even slightly normal and so I dropped it on the Met's reporting site.

Am I perhaps an hysterical old bat?

Pick Any Two

There is the famous security story of the honest consultant offering a system to a client: He asks them to pick any two from

• Cheap,
• User-friendly, and
• Secure

Reading the news today, I saw the latest idiot scheme to put every child on a secure government database, and I realised that it's the same thing.

"Secure Government Database?"

Pick any two.

Secrecy Preserving Protocol

From the Metro 2008-1-15:

.... he claimed a mystery royal had warned that Princess Diana's intimate conversations might be bugged. In a bid to protect the person's identity, Mr Burrell insisted on writing the name on a piece of paper and passing it to the coroner. Lord Scott-Baker then revealed three members of the family not named -- the Queen, the Duke of Edinburgh and the Duchess of York....

Nice balance.